Examkin

Soru

Zorluk: ZorCentralized Monitoring, Logging, and Auditing Solutions

A global retail conglomerate manages 340340 member accounts organized under AWS Organizations. The security team wants to implement a centralized logging architecture to consolidate VPC Flow Logs from all existing and future VPCs into a single Amazon S3 bucket located in a dedicated Security Operations account. The logs must be encrypted at rest using SSE-KMS, and member accounts must be prevented from disabling or altering the flow log configurations. How should a solutions architect design this solution to meet these requirements?

  1. A
    Create an Amazon S3 bucket in the Security Operations account, encrypted using the default AWS-managed KMS key (`aws/s3`). Configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal `s3:PutObject` permissions. Deploy VPC Flow Logs in all VPCs pointing to the central S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` unless the call is made by a designated administrative role.
  2. B
    Create an Amazon S3 bucket in the Security Operations account, encrypted using a customer managed KMS key. Configure the S3 bucket policy to allow the IAM root principal of each member account `s3:PutObject` permissions. Update the KMS key policy to grant the same member account root principals `kms:GenerateDataKey*` permissions. Deploy VPC Flow Logs in all VPCs pointing to the central S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` unless the call is made by a designated administrative role.
  3. Create an Amazon S3 bucket in the Security Operations account, encrypted using a customer managed KMS key. Configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal `s3:PutObject` and `s3:GetBucketAcl` permissions. Update the KMS key policy to grant the `delivery.logs.amazonaws.com` service principal `kms:GenerateDataKey*` and `kms:Decrypt` permissions. Deploy VPC Flow Logs in all VPCs pointing to the central S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` unless the call is made by a designated administrative role.Cevap
  4. D
    Create an Amazon S3 bucket in the Security Operations account, encrypted using a customer managed KMS key. Apply a Service Control Policy (SCP) to the organization root that allows member accounts to perform `s3:PutObject` on the central S3 bucket, while denying `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` unless the call is made by a designated administrative role. Deploy VPC Flow Logs in all VPCs pointing to the central S3 bucket without modifying the S3 bucket policy.

Cevap

The correct solution is to create an Amazon S3 bucket in the Security Operations account encrypted using a customer managed KMS key, configure both the S3 bucket policy and KMS key policy to trust the `delivery.logs.amazonaws.com` service principal, and apply a Service Control Policy (SCP) to prevent unauthorized tampering of flow logs across the organization.
The correct solution requires configuring a customer managed KMS key and an S3 bucket policy that both explicitly grant access to the `delivery.logs.amazonaws.com` service principal. A customer managed key is necessary because the default AWS-managed key (`aws/s3`) cannot be configured with custom policies to allow cross-account service principal authorization. Additionally, the Service Control Policy (SCP) acts as an effective guardrail to prevent modification of the VPC Flow Logs in the member accounts without attempting to grant access itself.

Adım Adım Çözüm

1
Determine the entity responsible for VPC Flow Log delivery.
Identify that the log delivery service uses the `delivery.logs.amazonaws.com` service principal rather than individual IAM identities.
This determines which principal must be granted permission in the S3 bucket policy and the KMS key policy.
2
Determine the type of KMS key needed for cross-account log encryption.
Select a customer managed KMS key instead of the AWS-managed key `aws/s3`.
AWS-managed keys do not support policy modification and cannot be configured to allow the log delivery service to generate data keys on behalf of other accounts.
3
Configure destination permissions and policies.
Configure the S3 bucket policy to allow `s3:PutObject` and `s3:GetBucketAcl` for `delivery.logs.amazonaws.com`, and the KMS key policy to allow `kms:GenerateDataKey*` and `kms:Decrypt` for the same service principal.
These resource policies are necessary to authorize the service to write encrypted files to the target bucket.
4
Implement governance guardrails at the organization level.
Apply an SCP that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` actions to the organization root, excluding administrative roles.
An SCP is the correct mechanism to enforce log integrity policies across all AWS member accounts.

Anahtar Kavram

Cross-account log aggregation with AWS KMS encryption and S3 bucket policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru